HSL Zuid
Phase II – Implementation Concept
Final Report
Study for alternative transport system on HSL Zuid
DB International GmbH
Central Germany and Western Europe Oskar-Sommer-Straße 15
D-60596 Frankfurt / Main 04.06.2009
Executive Summary
As extension of Study Phase I (Desk Research) DB International (DBI) has been assigned by the Ministry of Transport (Verkeer en Waterstaat) to substantiate the proposed alternative solutions and to evaluate the current commissioning concept of ETCS. The results of this extended evaluation are reflected within this report (Study Phase II – Implementation Concept).
Whereas in Phase I DBI has had a different view upon the situation of HSL Zuid than in Phase II, the approach did fundamentally change. In fact the current commissioning concept is far more promising than the initial situation was when DBI has been assigned for Phase I.
• Situation Phase I: The commissioning of ETCS is far behind the schedule due to Rolling Stock problems. DBI has been assigned to elaborate alternatives under the condition that even within 5 years time ETCS will not be in operation for revenue service.
• Situation Phase II: The track side assembly of ETCS has been certified. Even the proposed loco for public passenger transport, BR 186 (Traxx) has been certified and holds an “Inzetcertificaat”. Only minor issues have to be dealt with to commission the line.
Despite of this more optimistic estimation with regard to the HSL Zuid, DBI was asked to continue to investigate alternatives and drafted a concept for ATB-NG, PZB and “No-Control Command System” with evaluation of costs, time and implementation risks.
The results of Study Phase I can be confirmed here. If alternative solutions are required to mitigate risks of ETCS commissioning, PZB remains the preferred solution. ATB-NG would introduce at least equal risks than commissioning of ETCS Level 2.
However, DBI does even not recommend implementing PZB on HSL Zuid. PZB introduces the lowest efforts, costs, duration (implementation & commissioning) and risks for alternative solutions but in comparison to the current situation of ETCS commissioning it cannot be recommended as a serious alternative.
The current planning of HSL Zuid seems promising for the proposed Train / infrastructure combination. No major risks have been identified by DBI. But this is only applicable for the proposed combination as it has been tested, homologated and approved. For future updates of software, exhaustive testing and validation will be required in order to reduce the risks of deficiencies during operation.
ETCS Level 1 with 300 km/h also has to be seen as an introduction of new risks for the project. It seems that little modifications of the system are required to upgrade the system. However, the experience shows that each modification of the system requires new validation, safety analysis and approvals.
The main conclusion of DBI for Phase II can be drawn as follows:
HSL Zuid should continue their efforts to start public revenue service with ETCS Level 1 within a stable environment (dedicated train-track configuration).
Content Page
1 INTRODUCTION ... 5
2 ETCS ... 8
3 ALTERNATIVE SIGNALING SOLUTION WITHOUT CC SYSTEM ... 26
4 ATB-NG ... 36
5 ALTERNATIVE SIGNALING WITH PZB AS CC SYSTEM ... 48
6 CONCLUSION ... 59
Approval
Established Approved
Frankfurt/M, 04.06.2009 Frankfurt/M, 04.06.2009 Alfred Heneka, DB International
Ad Kloppenburg, Railinfra Solutions Stefan Bode, DB AG
Werner Geier, DB AG
Berthold Krall Peter Schließmann
Organization: s. above DB International
History
Version Date Author Modifications
1.0 19.05.09 DBI Experts Final Draft
1.1 22.05.09 DBI Experts Final Draft with corrections 2.0 04.06.09 DBI Experts Final Report
1
Introduction
The technical boundaries and chances for integrating an alternative system on HSL Zuid or to adapt the current ETCS system have been analyzed and prioritized by various criteria in Phase I (Desk Research). This study (Phase II – implementation concept) evaluates the implementation of the proposed solutions on basis of specific project information that has been provided by HSL Zuid. The experts of DB International (DBI) did not have sufficient insight in the system configuration of HSL Zuid during Phase I. Therefore several assumptions that have been made in Phase I, have been analyzed on basis of specific project documentation in Phase II.
Explicitly for ATB-NG, PZB and No-CCS (alternative solution to operate without active CCS-system) implementation concepts have been analyzed and described in the particular chapters. Furthermore the modification of the ETCS Level 1 to enable operation with maximum speed has been assessed. These systems are alternative solutions to the current ETCS system.
Concerning ETCS DBI did extend the reflections of Phase I on basis of more detailed information of the current ETCS system design, the homologation and certification status and the presented commissioning concept of HSL Zuid (during Kick-Off Session 09.04.09 in Utrecht). Hence DBI does provide a second expert opinion to report upon potential risks and chances for the commissioning and operation of HSL Zuid under ETCS.
The following experts have been involved to elaborate the study:
Project management / co-ordination: Mr. Dirk Ziegler, Mr. Peter Schließmann No-CCS, PZB: Mr. Alfred Heneka, Mr. Rene Zagrodnik
ATB-NG: Mr. Ad Kloppenburg
ERTMS: Mr. Stefan Bode
Rolling Stock: Mr. Werner Geier, Mr. Martin Stapff 1.1 Starting point
Besides the results of the study Phase I DBI has taken the current commissioning concept of HSL Zuid / ProRail into account for the study Phase II. A Kick-Off meeting has been conducted 09.04.09 by participation of representatives of HSL Zuid, ProRail and DB International. During this meeting DBI has been informed about the current status of HSL Zuid which is described in this chapter. According to statements of HSL Zuid, the technical conditions to start commercial operation are nearly fulfilled. Both infrastructure and Rolling Stock is apparently that far in certification, homologation and testing that the transport system is ready for commissioning to be operated as an integrated railway. The information as given to DBI reflects the status of march 2009.
DBI relies on the provided documentation and information of HSL Zuid. Consequently DBI did not assess whether the Notified Body (NoBo) or the National Safety Authority (NSA) have been taken sufficient care of the certification process. The focus of the study is on the current status and the commissioning concept and to check these against potential risks.
1.1.1 Commissioning Concept HSL Zuid
The commissioning of HSL Zuid is divided into phases by location (section North / South), train category (Thalys / TRAXX, BR186) and ETCS operation (Level 1 / Level 2).
The assessment of DBI is based upon the following scenario as presented by HSL Zuid to DBI: Start of commercial operation in August 09 on North section with passenger transport between Amsterdam and Rotterdam with the BR 186 (Traxx) under ETCS Level 1. For the time being, no specific plans exist to operate BR 186 on South section.
The Thalys will start commercial operation in December 09 (ETCS L1 on North / L2 on South). The buffers are incorporated to capture potential commissioning risks.
N o r t h S o u t h
Commissioning Activities Commercial Operation Traxx, ETCS L1
01.08.09
Commercial Operation Thalys, ETCS L1 Buffer
01.11.09
Commissioning Activities Buffer
01.12.09
Commercial Operation Thalys, ETCS L2
Commissioning Activities Buffer
01.05.10 SOUTH EXCLUSIONS •Traxx •Ansaldo Breda NORTH EXCLUSIONS •Traxx L2 •Ansaldo Breda
Envisaged commissioning date
Latest commissioning date
6 months 3 months
Image 1 - Commissioning Concept HSL Zuid 1.1.2 Status CCS Track Side Assembly
The track side assembly is certified for ETCS version 2.3.0 corridor. The respective certificates have been provided to DBI for review.
Regarding the RBC handover at the Belgian border the certification (including safety testing) is in place
1.1.3 Status Rolling Stock
Currently there are 4 trains foreseen for commercial operation: • Traxx locomotive, BR 186 with Prio coaches
• Thalys • BR 189
The Rolling Stock of Ansaldo Breda is not subject of this study. 1.2 Conditions
Specific restrictions and conditions have been considered for the study: • 5 hours maintenance window each night is reserved for the whole line
• The “Tunnel Groene Hart” (TGH) on section North has a speed limit for the Thalys of 250 km/h
• Speed limit of 250 km/h due to pressure waves on the Prio coaches • Temporary Speed restrictions are phased in
o L1: 80 / 120 o L2: 80 / 160 / 220
• The message to lower the pantograph at voltage change overs comes from ETCS Balises – to be taken into account for alternatives PZB, ATB-NG, CCS
• Ansaldo Breda trains are not subject of any investigation in this report
• The junctions to Breda and Zevenbergschen Hoek have not been considered in the investigation.
2
ETCS
The objective of this chapter is to assess the given concepts and alternatives, to identify potential risks and to make recommendations for their mitigation:
• Chapter 2.1 analyses the certification and homologation concept for the planned solution: ETCS L1 160 / L2 300 based on SRS 2.3.0 as currently installed on HSL Zuid. Based on international experience in ERTMS projects, recommendations for risk reduction for the planned solution will be made there.
• In chapter 2.2 the alternative solution of extending ETCS Level 1 operation to 300 km/h has been analysed on the basis of the proposal from Infraspeed.
• Specific questions related to the commissioning strategy are reflected in chapter
• In chapter 2.3 deals with the recommendations study Phase I which have been substantiated here on basis of the current situation.
• The situation of Rolling Stock related to ERTMS are described in chapter 2.4 2.1 Level 1 / Level 2 as currently installed on HSL Zuid
ETCS Level 2 is the main operating system for HSL Zuid whereas Level 1 is only a fall back system in case Level 2 is not in operation. The relevant certificates are provided and proof that the system is fit for purpose. However, not only the certificates are required as precondition for a successful operation. DBI has analysed the provided documents and reflects upon potential commissioning risks in this chapter.
2.1.1 General analysis of homologation concept for the trackside CC assembly For the following trackside constituents safety assessments, conformity certificates and declarations are available:
• Eurobalise S21, • LEU/MSTT, • LEU S21M,
No specific risk is expected from these components.
For the RBC (Radio Block Centre), the central component of the trackside equipment for radio-based ETCS, no conformity certificate was issued. Instead, for the RBC, including GSM-R interface, excluding axle counting system, GSM-R and on-board assembly, an interim statement of conformity is available. The report of the RBC concludes with limiting conditions and non-conformities that will have to be obeyed to grant coherence of the RBC in the systems configuration of HSL Zuid. The final conclusion of the report states that technical interoperability cannot be certified to the full extent as required by the TSI CCS. As no certificate of conformity is available, the supplier did not issue the declaration of conformity.
The non-conformities (Multiple non-revocable temporary speed restrictions within the same message, missing Balise Group at level transition STM-L1) reported and confirmed by ERA (European Railway Agency) lead to a restricted certification by the Notified Body (Interim Certificate of Conformity). However the non-conformities have been evaluated by HSL Zuid and ProRail with the conclusion that these do not constitute a safety risk or operational hindrance.
No specific risk is expected from these non-conformities.
Because the scope of Infraspeed (including Siemens / Thales as suppliers) deliverables does not expand to cover the applicable full set of functional and system requirements as specified by the TSI-CCS-HS for the trackside CC assembly, it is not legitimated to issue a „Certificate of EC Verification” with regard to the legal framework of that assignment. Therefore the results of the NoBo’s verification activities have been documented by means of an EC Verification Report whereby all limitations and shortcomings with regard to the overall verification scope have been made explicit. These points were summarised in three groups of pending issues:
• [PE1] GSM-R; (“not within the scope of Siemens/Thales”; “for EC Verification within the overall scope compliance will have to be evaluated on system level”)
• [PE2] Key Management;
• [PE3] Testing under full operational conditions as requested in the TSI CCS.
In particular, in the reports several indications have been made on issues that have to be tested and verified at system level [PE3].
Therefore on that stage, certification for commercial operation of HSL-Zuid was not possible. To cover the pending issues, in mid 2008 the NoBo has created the Conformity Assessment Report, taking into consideration additional documentation to close the pending issues [PE1-3]. The context of the documentation is reproduced here:
Image 2 - CCS Certification HSL Zuid
With this document, an integrated view on the trackside CC assembly was reached. This integrated approach should be kept.
The successful demonstration that Real Configuration Tests (RCT) has covered all open issues of the preceding reports is the key for final acceptance of the trackside assembly for operation. Issues could pop up from ISA / NoBo statements: e.g. testing under operational conditions, testing under consideration of human behaviour, shortcomings of rules, fall back scenarios, operation with multiple trains, etc.
Because of the key role of the test program, the following recommendation is made:
Recommendation #01
Due to limited information about the exact test- and validation methods, DBI gives a general recommendation for the border crossing.
Check the Validation Plan (describing the method of making, executing and reporting on the test cases) and the Test Plan for full coverage of the items indicated in the relevant ISA and NoBo reports. Special attention should be drawn to test related fallback scenarios and degraded situations, to the RBC-NRBC handover and tests with more than one train.
If this has been done by HSL Zuid and/or ProRail, as stated by HSL-Zuid and ProRail, and the respective certificates of the NoBo and the ISA are in place, then no specific risk is expected from the border crossing.
2.1.2 Track-Train integration process
The final goal of the HSL Zuid project is to perform safe High Speed operation at high performance level. This means that train operators must be supported to fulfil the necessary conditions.
The track-train integration for a certain train type includes the following aspects: • Have all exported constraints sufficiently been considered?
• Is the documentation presented by the Infra Provider complete and valid?
• Are the specific solutions of infrastructure (RBC) and Rolling Stock (OBU) interoperable? • Have all relevant operational test scenarios been demonstrated on system level?
Deficiencies in the co-ordination of the track-train integration would be a major risk for the project timetable.
Recommendation #02
To reduce the project risk, the track-train-integration process should be co-ordinated and supervised by a System Integrator (see also the report phase I). The operational way of organizing the activities of a System Integrator may depend of the level of maturity already reached on the HSL-Zuid. DBI recommends that the parties involved, under supervision of the actual System Integrator (the Steering Committee HSL-Zuid) establish an analysis based on the examples SBB and/or ADIF, on which they also have to take into account the already achieved maturity, to establish the best way to proceed the integration activities.
Best practice examples:
In international projects, the System Integrator role was implemented in different ways, for example:
• In Switzerland by the Infra Manager SBB, also managing the IOP project establishing a rail interoperability laboratory
• In Spain by the Ministry (MFOM), with an independent laboratory at CEDEX (see image 3)
Image 3 – System Authority - ADIF
Remark: A system integrator is particularly needed when the system is immature. A system, in this case ERTMS, is considered immature when much of the problems encountered are caused by multi-interpretable specs (suppliers each develop their own solutions) in a specific sub-system and/or are cross-problems. The latter: both sub-system specs are correct and correctly implemented, but the combination does not work.
Whenever the system gets more mature all these kind of problems are solved. DBI was not able (within the timeframe for elaboration of this study) to determine the level of maturity already reached on the HSL-South. Therefore DBI is stating the best-practices from abroad as an example, rather than evaluating the actual situation on the HSL Zuid. If the maturity of ERTMS-systems on HSL Zuid is higher, the role of the system integrator will become less extensive.
A supporting tool is provided in appendix 7.2: A risk checklist that could be followed up by the System Integrator. It contains some general project risks, reflecting issues that have been
2.1.3 Testing on HSL Zuid
EVC’s (European Vital Computer) of several onboard units were used to perform the so called RCT tests (Real Configuration Test). Following configurations were available:
Loco OBU ETCS Level
BR203/G1206 (Diesel locomotives)
Alstom OBU in combination with an Alstom STM-ATB
Level 1, Level 2, transitions conventional network and Belgium
HLS6264
(Diesel locomotive)
Alstom OBU Level 1, Level 2, transitions Belgium
Thalys/PBA Ansaldo/F OBU in combination with an Alstom STM-ATB
Level 1, Level 2, transitions conventional network and Belgium
Thalys/PBKA Ansaldo/F OBU in combination with an Alstom STM-ATB
Level 1, Level 2, transitions conventional network and Belgium
BR186, TRAXX Bombardier OBU in combination with an Bombardier STM-ATB
Level 1
Taurus Siemens Onboard unit Level 1/2 and transition Belgium
BR189 Alstom OBU with an Alstom
STM-ATB
Level 1, Level 2, transitions conventional network and Belgium
Table 1 - ETCS Locos for RCT Testing
The variety of OBU used is a positive indication for the stability of the trackside solution.
Test Duration
From starting testing in 2005, lots of test activities have taken place in the last years on HSL Zuid, including border crossing with different trains. This has resulted in several SW corrections and adaptations. On the other hand, the analyses of the integrated transport-need and/or trains also in other projects have resulted in stepwise adaptations of the implemented version of the ERTMS specifications (2.2.0 - 2.2.2 - 2.3.0).
However, detailed assessment of the test results is unavoidable for a conclusion on the maturity of the process. In the scope and information available for this report, the extent and validity of the test runs already accomplished by trains on HSL Zuid cannot be fully evaluated. Therefore no sound forecast is possible for the remaining duration of tests to reach full operational speed and train frequency.
Some examples from test duration in real projects and factors influencing the test duration are given in the next chapter.
Test Specification
It is supposed that the test specification “Track to Train Integration Default test set for ETCS L1 and L2 (Version 2.1 Final)” was used for these tests. Some issues regarding the test specification should be checked by the System Integrator:
• Has the validity of the following statement been checked: “Malfunctioning and defects in trackside equipment is out of the scope for degraded functions, because it is the opinion
that such malfunctioning shall be part of the respective safety case for Rolling Stock and track.”?
• Does TSI certification allow the use of MIL standard in place of CENELEC?
• Have all exported constraints been checked in their context, impact etc. and tested if applicable?
• Can testing “once” cover the relevant range of parameters? lab testing requirements 2.1.4 Best practice for Interoperability Tests (IOP)
Remark: The abbreviation IOP in this chapter is used for Interoperability, especially in the context of exhaustive testing of the compatibility of an RBC with EVC products of different suppliers.
The approach selected for HSL Zuid for the Trackside CC Assembly is based on the following assumption:
“According to the TSI CCS, chapter 6.2 the declaration of verification of on-board and trackside assemblies, together with the certificates of conformity, it is sufficient to ensure that an on-board assembly will operate with a trackside assembly equipped with corresponding functions as defined in the register of Rolling Stock and in the register of infrastructure without an additional subsystem declaration of verification.”
(EC Verification Report / Interim Statement of Conformity)
However, the above assumption must be seen as a mid-term target. The consolidation of the European specifications has not been finished. The realisation of the ERTMS projects around Europe has revealed many gaps and uncertainties in the TSI, resulting in an incremental improvement of the specification by introduction of CR (Change Request) and iterating publication of updated technical specifications (e.g. SRS 2.0.0, 2.2.2, 2.3.0d). Many problems were pragmatically solved on product level. The formal verification of conformity with the technical specifications is a necessary condition. Despite of the high symbolic value of an EC Declaration of Verification for the assembly, it does not guarantee full interoperability and safe co-operation of specific on-board and trackside assemblies under specific operational conditions.
To mitigate the risk of stepwise discovery of problems during commercial operation, extensive testing of the full system range is required.
Best practice example (RFI, Roma-Napoli Level 2 High Speed Line)
In April 2004, first trains were running at 300 km/h under ERTMS full supervision.
The line has opened 21 months later for passenger operation after extensive and exhaustive testing. Testing on site was systematically supported by laboratory testing in the RFI test laboratory, using the original HW, SW and engineering data of the line and train.
It took another year to go from 2 connections per day to nominal situation (12 per day). (A similar observation was made in the commissioning process of the Betuwe Line.) Best practice view of an UNISIG supplier:
“Site tests without prior intensive lab tests require a lot of efforts, for a low coverage of ETCS functions. Interoperability cross-tests cannot substitute comprehensive testing.” To avoid a scenario of “endless on site testing”, especially for ETCS Level 2, systematic interoperability testing, including laboratory testing, is recommended. See also the considerations in the best practice example from Adif:
Image 4 – Conclusions ADIF
Best practice example (Deutsche Bahn, Level 2 pilot line Berlin-Leipzig)
The coverage of testing functionality and safety related issues by supplier’s lab tests did not fully convince the NSA and Infrastructure Manager. As a result, the system (track + train) had to be tested extensively after delivery on site. Several software adaptations were necessary due to detected findings during testing. As a consequence the commissioning for passenger transport has been delayed by almost 2 years. The
Best practice example (SBB, concept for safety approval for trackside X with train type M/L/N) An overview of the SBB Process for safety approval is attached in appendix 7.3. The overall safety case (I) takes into account the safety cases of the assemblies (II-for each train type M/L/N, IV-for trackside X) as well as an integrated safety case for the specific combination train type M/L/N with the trackside X (V).
Because of the immaturity of the European specifications, and forced by major interoperability problems and project delays, during the SBB projects a supporting process of IOP testing (III) was set up in a specific test laboratory environment, bringing together the RBCs and EVCs of different suppliers for IOP testing. The results of IOP testing of the RBC used in track X with the EVC used in train M/L/N (III) are taken into account in the overall safety case.
IOP testing covers a broad set of test cases specified according to the specific track implementation & operational principles. It consists of a laboratory test session (using the real RBC and EVC equipment) and complementing site tests for test cases that cannot be featured in laboratory. IOP testing is effected by the respective suppliers and should be spot witnessed by the System Integrator and certification bodies.
Although this kind of test is not requested (and not intended) by TSI, it enhances confidence in the product compatibility and significantly reduces project risks. Findings are mainly product related, in some cases also related to different interpretation of the TSI specifications.
In particular for the RBC, the European Specifications are still leaving too much freedom for implementation for the suppliers. As a consequence, EVCs that have been successfully tested within a specific RBC environment, frequently failed in a different RBC environment because the engineering choices taken for the second RBC (e.g. frequency, sequence or composition of data transmitted) were different.
The following “IOP-status” has been reached for the Thales RBC: EVC supplier IOP (lab + site)
test campaign
reference project *)
Real Configuration Tests (by HSL Zuid Project organisation) with target train and target HW/SW version
EVC Alstom YES
(Lötschberg version) Lötschberg BR189: tests planned for HSLZ
EVC Ansaldo/F not known none Thalys: some tests done on HSLZ, still
problems (as of march 2009) EVC
Bombardier (Lötschberg version) in preparation none TRAXX: tests on going on HSLZ
EVC Siemens YES
(Lötschberg version, HSL Zuid version) Lötschberg, Berlin-Leipzig not planned
Table 2 - Interoperability status Thales RBC
*) To decrease the risk for HSL Zuid, a full-range test campaign of the relevant supplier combination in the frame of another project could be referenced. In this case the supplier compatibility is proven at least for the specific RBC solution and SRS version (222+X, with “X” project specific). However, the specific operational requirements and technical solutions for the HSL Zuid would not be fully covered.
The duration of one IOP test campaign for Level 2 can be assumed 3 weeks laboratory plus 2 weeks site tests per session (one EVC). In case that IOP problems will be found that require an upgrade of the on-board software, this upgrade would take further 4-6 months, including repetition of the relevant part of the test session.
For HSL Zuid RBC/engineering IOP laboratory and site tests have already taken place with Siemens EVC. Thus, it can be assumed that all technical conditions (IOP test scenarios, etc.) for testing with other EVCs are available.
Recommendation #03
To decrease the project risk, for each planned train it should be verified if the extensive HSL Zuid test activities of the past years are already equivalent with a laboratory supported exhaustive IOP test campaign as described above, i.e. if they have appropriate coverage of functions and parameters and were based on the target HW/SW/engineering versions of EVC/RBC.
If not, it should be stipulated for each combination RBC (Thales) – EVC (Alstom, Ansaldo, Bombardier) that IOP testing will be completed, using the project specific RBC hardware/software/trackside engineering version and based on the project specific operational scenarios. This could become a condition of ProRail to the supplier/TOC for access of the respective train for final system validation tests (Real Configuration Tests) For the HSL Zuid project a supplier independent laboratory environment does not exist. The use of the supplier’s laboratories seems the only realistic way to complement site tests by lab testing. As a measure to reduce the duration of the testing period, ProRail could attend the IOP site tests and on that basis decide which of the system validation tests are already covered by the IOP test campaign.
Remark: In the meantime, UNISIG has developed the IOP test approach into a universal concept of interfacing supplier’s laboratories (see UNISIG subset-110/111/112). This is supporting the implementation of projects and product debugging in a pragmatic way. However, the railways’ interest is to improve the TSI standards in such a way that in the future (ERTMS Baseline 3) the EC Verification process will be sufficient to ensure interoperability.
2.1.5 Best practice for Integrated Safety Case
A second conclusion can be drawn from the SBB concept for safety approval (see appendix 7.3). The project documentation includes an individual safety case for the specific combination train type M/L/N with the trackside X (V) as well as an overall safety case (roof document) for this combination (I). This document should be part of the technical file for TSI- and ISA assessment RS.A similar document or a concept describing it, was not included in the documents available for this study. (I) Overall safety case for track X and train type M/L/N: Roof safety case document which is certifying that any train of type M/L/N can safely operate on track X (engineering, operation) and all necessary documents (safety case, expert’s report, validation reports, etc.) of the previous process steps for train type, track and their interaction are complete, in form and content correct and available.
(V) The Safety Case for the safety relevant application conditions from track to train and vice versa. Evaluation and verification of the implementation of the resulting measures. Includes a test report for the verification of the tests prescribed by the IM (Infrastructure Manager).
In the SBB process, the infrastructure manager is responsible for these documents. This process was successfully applied for the commissioning of hundreds of ERTMS Level 2 trains from different suppliers, including the ICE 1 trainset from Deutsche Bahn.
As we understand an Integrated Safety Case, including the effects of extensive IOP-testing, incuding lab and on-site RBC-testing, including cross-border RCT, for the HSL-Zuid has been already established. This suggests a higher level of maturity, and therefore an adapted approach towards integration can be considered.
Recommendation #04
The current commissioning concept of HSL Zuid is based on a dedicated train-track configuration that has been tested and validated. Any crucial change of configuration (e.g. Rolling Stock / OUB – Infrastructure / RBC) requires further tests and train-track-integration processes.
The integrated safety case (V) is the central document for the Homologation of the signaling system in the train in its specific national operating and technical environment. The overall safety case (I) is the basis for the authorization (NSA) to start operation.
2.1.6 Summary
• The certification and homologation concept is in general applicable, enhancements to gain integrated view are recommended.
• The documentation assessed for this study do not allow a sound forecast of the maturity of the transport-system and therefore on the remaining duration of tests to reach full operational speed and train frequency.
• The train-track-integration, including an integration safety case should be co-ordinated and supervised by a System Integrator. The actual way of organizing the activities of the System Integrator may depend of the level of maturity reached on the HSL-Zuid. The checklist (7.2) can be used to determine this level of maturity.
2.2 Level 1 with 300 km/h
Even though ETCS Level 1 is a fall back system on HSL Zuid, it could be also used for commercial operation. Considering the commissioning concept of HSL Zuid the benefit would be to operate the Thalys on North with High Speed. The current commissioning concept does not envisage the operation of ETCS L2 on North.
The current system design of ETCS Level 1 has been established on basis of maximum speed 160 km/h. It is possible to operate L1 also with higher speeds. This depends on the technique, operational rules and safety rules and varies from country to country.
Infraspeed established a concept how the current L1-system on HSL Zuid could be modified in order to enable the operation with maximum speed up to 300 km/h.
DBI performed a brief assessment of the concept. The conclusions are comprised in this chapter. 2.2.1 Description of Status Quo
For the HSL Zuid line ETCS Level 1 with 160 km/h is installed as a fallback system. The interlocking and the position of the balises as well as the block sections are designed for maximum speed of 160 km/h.
The block sections are identified by markerboard on the track. The markerboards are equipped with overrun lights. The overrun lights show the “drive”-aspect of the virtual signal. The line has no infill information by infill balises or infill loops.
The existing balises are built in the gap of the derailment plinth. For this reason it is difficult to adjust the existing balises or mount additional balises.
The signal aspect is shown to the driver by the ETCS onboard unit. Because there are no infill balises and no infill loops, a changed signal aspect won`t be transmitted to the onboard unit in front of the signal. The signal aspects are only transmitted to the onboard unit when the train passes the balises at the location of the markerboards.
2.2.2 Balises
The North and the South section of HSL Zuid has in total about 400 Balise groups with approximately 650 balises. About 400 of these balises are fixed balises with static telegram. An update of the balise telegrams is not required according to the current planning but has to be investigated within an explicit system design.
2.2.3 MSTT
The switchable balises (transparent balises) are controlled by MSTT (modular locally controller). The MSTT receives the Movement Authority by ISDN-bus from the interlocking. All this information must be changed for an upgrade of the speed to 300km/h. To realize this change, a project data modification at MSTT is required.
It is possible to change these data during the weekend but it is scarce due to required tests and time to adapt the data of approximately 250 MSTT.
2.2.4 Interlocking
Minor modifications of project data in interlocking are required to extend particular blocksections (in front of tunnels).
Infraspeed distinguishes between interlocking system software and engineering data. The engineering data depends on the topographic and operating parameters, not the system software. According to Infraspeed this modification is not a crucial system change and can be applied without major approval and safety processes.
Based on past experience, DBI recommends to assume that the combination of system software and engineering data will have to be tested together. In Germany a change of project data is a crucial system change and requires comprehensive validation, testing and safety analysis.
2.2.5 Additional Balises
Infraspeed determined a minimum of 4 additional balises to enable the upgrade to 300 km/h with the ETCS Level 1 system. These 4 balises should replace the existing ones. Nevertheless, an explicit design could result in additional balises. Furthermore the adjustment of the position of existing balises could be required. This is associated with high costs and time because of necessary construction works at the derailment plinth.
2.2.6 Certification and approval
The redesign details for the upgrade of ETCS Level 1 – 300 km/h have to be designed, approved, tested and verified. ETCS Level 1 with 160 km/h is designed as a fall back system to increase the availability of the track. For this purpose it was installed, tested and certified. The NoBo’s Interim Certificate of Conformity is defining the range of the certification as follows:
“HSL-Zuid CCS trackside assembly is designed to operate in ETCS Level 2 as the regular mode of operation. Degraded or fallback operation is supported by means of ETCS Level 1.”
The frequency of the usage of a technical and operational solution (regular or fallback) and the speed at which the system will be used (160 or 300 km/h) has an implication on the quantitative safety target of the overall system. In the documents available for this study, no reference was made to such analysis. The concept of Infraspeed did not reflect upon this scope.
2.2.7 Conclusions
In order to use ETCS Level 1 as the regular mode of operation at 300 km/h, it is necessary to adapt the safety case as well the certification and approval by the Notified Body and the NSA (National Safety Authority). This is a major project risk.
Infraspeed intends to test the components and the software with known scenarios in a laboratory. This does not replace track side tests with the original hardware, trains and the original operational conditions. The trackside upgrade to ETCS Level 1 with 300km/h must be tested before start of commercial operation.
A trackside redesign from 160km/h to 300km/h (e.g. on a weekend) is accompanied with risks for the line in operation. More time might be necessary to transfer the system from L1 160 km/ to 300 km/h. This depends on the test program on-site, the scenarios to be tested and the requests of the NSA, ISA and responsible operators.
Summary:
Even though that the concept of Infraspeed is a considerable solution to upgrade the system from ETCS L1 160 km/h to 300 km/h, it has to be thoroughly prepared, especially by involvement of NSA, ISA and the operators. The current concept does not yet contain details about an on-site test program, scenarios to be tested and the required efforts for safety approval.
Risks remain for the project, if this solution would be implemented during HSL Zuid is in operation (e.g. during weekend). The time to execute all required activities for re-programming, testing and approval is scarce.
To allow a comprehensive analysis of the impact and risks, the concept should at least contain: • Detailed system design
• Program of lab testing
• Operational Impact Analysis and concept of scenario testing • Train-Track integration analysis
• Safety Case / Certification analysis – NSA, ISA • NoBo process and contractual consequences • Commissioning & testing strategy
2.2.8 Stepwise commissioning
The commissioning concept as presented for this study includes two major steps:
• Step 1: Level 1 operation with TRAXX on the North section
• Step 2: In addition level 2 operation with Thalys at the South section and level 1 operation with Thalys on the North section
International experience is showing that in the most cases a stepwise approach was implemented instead of a sudden start of full commercial operation under ERTMS responsibility. Typical steps in this process are:
1. Site tests without safety responsibility of ERTMS (SeoSV)
They are used to check technical functions as part of IOP and system validation. These tests require train protection by other measures and have strong impact on lines that are already in operation. An option is that a conventional fallback system is used and ETCS is running in parallel. Such fallback system is not available for HSL Zuid.
At HSL Zuid, the Thalys and BR 189 trains are still at this stage. 2. Site tests with safety responsibility of ERTMS (SEmSV)
These tests take place in the real operational environment. These tests normally start under specific observation (e.g. second driver) and without passengers, in High Speed projects sometimes at reduced speed. They are used to collect performance and reliability data to supplement the safety case and to gain confidence for revenue service. The impact on lines already in service is limited.
At HSL Zuid, the TRAXX train is at this stage for level 1 at the north section (Inzetcertificaat).
3. Revenue service with restrictions (reliability test)
These tests allow commercial use of the system, but still with restrictions on the operations like reduced train frequency and specific observation. After a period of successful operation without incidents the restrictions will be released.
The overall duration (from 1 to 3) can take up to two years (see best practice examples). Period 3 takes the main part – the restrictions in train frequency have to be accepted for about 12 months. The duration of period 1 and 2 is mainly depending on the number of iterations, i.e. software changes and subsequent repetition of tests; each iteration extends the period by about 4-6 months. Therefore, on the basis of the documents and timeframe available for this study, a sound estimation of the remaining test duration for the trains on HSL Zuid (to reach full operational speed and train frequency) cannot be made.
Recommendation #05
• A stepwise commissioning process should be envisaged, including a long period (<>12 months) of commercial operation with limited train frequency.
• Efforts for reduction of the testing period should focus on the first step, because these tests are very difficult to organise when a line has been already started revenue service. Reduction can be reached by the use of extensive IOP testing in laboratory (see recommendation #03).
• Due to additional risk, cost and time it is not recommended to install a national fallback system only for the testing period.
The envisaged frequency of trains for the first 2 years of operation on HLS Zuid (see also report Phase I), would enable the execution of the third (reliability) test phase. 2.2.9 Regression Testing
Site tests without safety responsibility are necessary for each new train on the line. But also in case of software changes at a (homologated) train for this line (bug fixing, functional enhancements, upgrade to SRS 2.3.0d or SRS 3.0, etc.), some tests without safety responsibility could become necessary.
After start of operation, these tests must be normally done in periods without regular train operation. HSL Zuid is a pure passenger line. Free periods (at least 2-4 hours) probably will be available during the nights. Nevertheless, these tests remain expensive and difficult to organise and a reduction of site tests on the operational line by enhancement of the laboratory tests is recommended (see recommendation #03).
2.2.10 Applicability of level 1 as regular mode of operation
The Interim Certificate of Conformity is defining the range of the certification as follows:
“HSL-Zuid CCS trackside assembly is designed to operate in ETCS Level 2 as the regular mode of operation. Degraded or fallback operation is supported by means of ETCS Level 1.”
The frequency of the use of a technical and operational solution has implications on the quantitative safety target of the overall system. In the documents available for this study, no reference was made to such analysis.
Recommendation #06
Although the preparation of the commercial use of the HSL-Zuid with TRAXX (Prio) under L1 is at an advanced stage, including the involvement of the NSA, it should be checked with the NSA if the use of ETCS Level 1 as a safe regular mode of operation is acceptable. The Certificate of Conformity might have to be extended.
2.3 Substantiation of recommendations report Phase I 2.3.1 System Integrator
Study, Phase I recommendation:
It is recommended to bundle all responsibilities for the overall system (ETCS trackside and onboard equipment, GSM-R, test equipment) in one hand, e.g. ProRail, and to privilege this System Integrator with the necessary decision competence for system integration issues. This should be required in particular with regard to definition, execution and evaluation of tests.
This recommendation has been substantiated in this report, see recommendation #02.
2.3.2 Test Train and High Speed Serial Trainset Study, Phase I recommendation:
For the preparation of commercial operation with High Speed trainsets, the early acquisition of a Test Train with ETCS equipment of the planned serial High Speed trainset’s ETCS supplier is highly recommended. Ideally, this Test Train should be owned by the System Integrator. With this train could be done onsite tests yet before delivery of the first serial trainset.
The gist of this recommendation was in fact fulfilled by the RCT program, using OBUs of
different suppliers. Related to the Ansaldo Breda HS trainset the recommendation remains in force. 2.3.3 Test Laboratory for ETCS Level 2
Study, Phase I recommendation:
For the system integration of ETCS Level 2 is further recommended that at an early stage the supplier should provide the original HW/SW configuration including trackside engineering in a Test Laboratory.
On-site tests are more expensive and time consuming then laboratory tests. Extent and quality of laboratory tests have substantial impact on the extent and success of on-site tests! Laboratory tests can start early before delivery of a train and will reduce the time between train delivery and putting into operation.
This recommendation has been substantiated with a concrete proposal to stipulate IOP testing
by the suppliers, see recommendation #03. 2.3.4 Homologation Process
Study, Phase I recommendation:
It cannot be assumed that the declaration of conformity with the TSI will be sufficient to reach the safety targets. … To minimise this risk, it is recommended that the System Integrator, yet before the Serial Train will be available, agrees a project specific approach with all involved parties (both suppliers, NoBos, NSAs, train operator, track operator).
Based on the best practice example of the SBB process for safety approval, this
2.3.5 Specific Analysis on NRBC handover Study, Phase I recommendation:
To minimize the risk for putting into operation ETCS Level 2, an interim solution with border crossing via ETCS Level 1 should be envisaged.
This recommendation has been overruled by the actual HSL Zuid Commissioning Plan.
However, in the documents available for this report, no explicit evidence was found that the RBC-NRBC handover has been sufficiently tested, taking into account the remarks from the underlying reports. E.g. the ISA report of 15.05.2008 states: “The crossing of the border in ETCS level 2 is only allowed for test purposes, without any safety responsibility of the RBC.” This was reflected in
recommendation #01.
Remark: DBI has been informed that the actual state of the border-crossing (RBC-handover) might be more advanced than the quoted ISA-report suggests. The status of the quoted report is May 2008. DBI has not been able to check this statement in the limited time available.
2.4 Rolling Stock ETCS
Test runs with the train sets Thalys and the loco class 186 have been executed on HSL Zuid. DBII assumes that these test runs with the locos were successful. The loco class 186 holds an “inzetcertificaat for proefbedrijf", which means that all types of transport apart from driving with actual passengers is allowed. There is no technical hindrance to upgrade to commercial operation. The loco class 189 also has made some test runs on the HSL Zuid. The final results are not known to DBI and apparently also the VGB for commercial use is not yet in place. To get this VGB the homologation could be made on the basis of the test results and the reports of the NoBo. Currently there are test runs on the HSL Zuid with loco 189 065 including the newest software from Alstom for Level 2 SRS 2.3.0.d (called 5.2.0.+).
The Thalys train sets have some problems in the test runs and must be optimized. The Thalys is currently only released for testing. It is currently planned to return to the track with software version 7.2.3.1 RC2 in the middle of the year 2009 for final testing. The Thalys train sets could be ready for public traffic in minimum 9 months (6 months for testing, 3 months for homologation). The PBKA Thalys are currently in alteration and will be ready until February next year, the alteration of the PBA Thalys are nearly ready.
2.4.1 Homologation
2.4.1.1 Homologation (Evaluation of certificate Traxx BR 186)
The result of the researches by the manufacturer of the loco class 186 is the statement that the VGB for ETCS Level 1 at the HSL Zuid is still applicable. There is no restriction in the homologation. This is also verified by ProRail. There is no further homologation necessary.
2.4.1.2 Homologation (Evaluation of certificate Thalys train set)
After the new test runs beginning in May 2009- over at least 6 months there is in addition a homologation time of approximately 3 months (to proof the safety cases, data preparation, exported constraints, etc.).
2.4.2 Potential risks
Therefore there will be no risk coming from the loco class 186. To use the loco class 189 for public operation a VGB is required. A risk is coming from the Thalys and its modifications. Test runs are required to validate the modifications before commercial operation.
2.4.3 Recommendations
The decision to use the loco class 186 for the commercial traffic under ETCS L1 on the HSL Zuid is connected with the lowest costs and risks and the commercial traffic can be started immediately. The next possibility to start with a commercial traffic is to use the loco class 189. Here it is necessary to obtain a VGB (approximately 3 months).
The Thalys train sets are ready for use in minimum 9 month after beginning the final software test. It is possible that these tests are not successful and more tests are needed for a homologation and the commercial traffic. In this case the time to use the trains set will be extended.
Time and costs: Time months 1 2 3 4 5 6 7 8 9 10 11 12 BR 186, L1 BR 189 Thalys Homologation
Final Test Homologation
Table 3 - Timeschedule Rolling Stock ETCS
Costs T Euro 50 100 150 200 250 300 350 400 450 500 550 600 650 700 750 BR 186, L1 ---BR 189 Thalys Homologation
Test Runs Homologation
3
Alternative Signaling Solution without CC System
3.1 IntroductionThe implementation of new signaling systems requires temporary solutions for the transfer from one stage of implementation to the next. During such work phases, it is common praxis to accept a reduced technical safety level for limited periods and to mitigate the remaining risks to an acceptable safety level by procedures and additional staff resources (e.g. second train driver). Also for HSL Zuid, such solution could be applied. The proposal made hereunder could become operational for a certain period at an acceptable safety level. It forms the basic requirement for the ATB-NG and PZB solution. That means, the so-called “No CC-Solution” constitute the technical basis for the ATB-NG and the PZB solution, e.g.:
• Installation of announcing signals at the entrances of HSL Zuid • Clamping of switches (emergency cross-overs)
• Prevention trains entering a tunnel in calamity mode
• Prevention collision of train with a water barrier closing or in failure mode 3.2 Brief presentation of functionalities
3.2.1 General
“No-CC system” means that trains are running on the HSL line without train protection system and within the boundaries of conventional signaling with the existing ATB-EG system.
The safety critical issues are
• Respecting the maximum speed on the HSL line
• Protection of the emergency cross-overs and branch lines on the HSL line
• Ensuring safe train spacing by combining the block section on the HSL line to one section between the adjacent conventional sections
• Ensuring safe train speeds by reducing the speed on the approach to the home signal when the home signal shows danger aspect or reduced speed.
The layout of the HSL line from Hoofddorp to the Belgium border is shown on the figure below. The HSL line signaling is made without wayside block signals and without protection signals for crossings, junctions or for tunnel protection. These functions are embedded within the ERTMS system. Without ERTMS system, these protective functions must be substituted by wayside signals or by other measures. The introduction of wayside block and protection signals have been abandoned during the first phase of the study due to the high costs, the resulting fundamental changes of the already installed systems and the considerable time span for implementation. Therefore, in this report only alternative measures will be described, which do not require extensive modifications of already commissioned interlocking.
The basic requirement for the No-CC system is the permanent locking of all elements on the track between adjacent conventional sections and combining the multiple block sections to one block section between two conventional sections. For train operation up to the border to Belgium the line bifurcation to Breda and Zevenbergschen Hoek must be neutralised. The analysis stops at the border to Belgium. It is understood that similar modifications are necessary on the Belgium side
Image 5 - Principle line configuration "No-CC system" 3.2.2 Respecting the maximum speed on the line
Without CC system, the train speed is technically limited only by the train propulsion system itself. To limit the train speed by limiting the traction current of the train is technically feasible but not recommendable. In the case of HSL Zuid and considering the locomotives, which are planned to operate, we can see that nearly all train sets are already equipped with the PZB onboard unit, except the Thalys PBA where minor modifications are required. Therefore, it is recommendable to use the PZB on board unit for limiting the line speed independently of the line side PZB application. For safety reasons, the speed might be limited by procedure to 140 km/h whereas the emergency brake will be triggered at 165 km/h by PZB without line side PZB installations.
3.2.3 Protection of turnouts on the HSL section
Protection of the emergency crossovers connection points to the branch lines can be made as follows:
• Protection by wayside signals train routes and integration into the interlocking • Mechanical locks and key release instruments on site
• Mechanical locks and key release instruments in the adjacent signal operator room • Mechanical lock and sealing the key in the next signal operator room
• Electrical locks on site
Emergency crossovers are not required for the temporary operation. Therefore, it is proposed to lock the cross-over by mechanical locks. For short period, it would be sufficient to seal the key on a key board inside the adjacent signal operator room. For longer periods, the key should be locked inside an indoor key release instrument. For manual reversing of the cross over e.g. for maintenance work, the key has to be taken and the turnouts unlocked on site. Reversing should be made only by hand operation (cranking).
Emergency crossovers will be set in the straight position and mechanically locked by safe locking devices. The locking mechanism shall clamp the closed blades to the stock rail and shall ensure a sufficient gap for the passing wheel flanks. An example of such point hand locks is shown below.
Image 6 - Handlock for switches
Only when the blades are in the correct final position and locked, the key can be withdrawn.
Electrical locking devices require modification of the interlocking system and extension of the cable network. An electrical locking system is considered as to excessive for the temporary situation except for the branch lines.
The turnouts leading to the branches to Breda and to Zevenbergschen Hoek should be neutralized and locked in the same manner. Maintaining traffic on these branch lines would require temporary interlocking installation with all necessary modifications, which is considered as to excessive for a relatively short period of operation. The implementation of such interlocking would not be possible within 3 years. The key for the protection of the turnouts leading to the branch lines should be locked in a key release instrument or the turnouts should be locked electrically and supervised by the interlocking and block system.
3.2.4 Combining the block section on the line to one section between two stations The line section between two adjacent conventional sections is divided into block sections where each block section can berth one train with a safety distance to the next train. Without line side block signals or without ERTMS, only one train is permitted per track between two adjacent conventional sections. Therefore, the block system must be complemented by a station-to-station block system. In order to ease the modification and to avoid heavy retesting at a later phase it is recommended to install a complete new axle counter system for the station-to-station block and keep the already commissioned signaling infrastructure - as far as possible, unchanged. The already placed ERTMS stop markers should be covered. In case of space or cable constraints for additional axle counters, the rewiring of the first and last axle counter point could be considered. To monitor the additional axle counters, the same system has to be applied as for the existing axle counters. The particular connections have to be realized.
3.2.5 Reducing the speed on the approach to the home signal
Train drivers must be informed in advance when approaching a home signal in order to be able to reduce the speed accordingly, either to stop in front of the signal, when showing danger aspect or to pass at a reduced speed. For this purpose, the installation of a distant signal at the braking distance to the home signal is compulsory. For systems with active train protection, the speed and the brake curve is supervised by the CC system. A potential hazard exist for trains without active CC system in the sense that train drivers may not recognize the distant signal aspect or they will not react correctly for whatever reasons. Therefore the speed for railways without CC system is normally limited e.g. in Germany to 100 km/h -120 km/h. The distant signal has to be connected to the home signal of the conventional line.
3.2.6 Train operation in normal direction of traffic
Train operation on HSL lines will be based on the correct driver actions according to the signal aspects. Within the boundaries of conventional signaling, the speeds and correct driver reactions are supervised by the ATB-EG system. The driving of a train with the correct speed profile depends on the performance of the train driver. On the HSL line, a second driver should be employed for safety reasons. As an additional mitigation measure, the line speed should be reduced to 140 km/h by procedure whereas the train borne PZB –if applied - will trigger the e-brake at V > 165 km/h
3.2.7 Reverse signaling
For the reverse direction, the distant signal could be replaced by a dummy mechanical signal or a special plate that indicates to the train driver a permanent “Warning” aspect, meaning the home signal shows danger aspect. When approaching the main signal, the driver can recognize the true main signal aspect and react accordingly. From DBI point of view, this solution could be applied for the reverse direction but not for the normal direction of traffic. Otherwise, the signal clearing to the reverse direction should be blocked and trains might operate in reverse direction by running at sight. The signal blocking to the reverse direction can be easily implemented via the new station-to-station block system.
Protection of reverse running is considered as an option and is not included in the cost calculations.
3.2.8 Tunnel Protection / Water Barriers
The tunnel protection is required in order to inhibit train movements into tunnel section when the tunnel supervision system is in alert status. For protection of the tunnel, three solutions seem to be possible:
• Protection by wayside signals, controlled from the CBI (Computer Based Interlocking) with or without train sectioning functions
• Protection by wayside signals controlled from small local control devices, not included in the train sectioning system
• Blocking the departure of the adjacent conventional sections, when one of the tunnels on the line section is in alert status. (This solution is also applicable for water barriers)
The first solution is considered as not feasible due to the involved excessive modifications and exceeding the possible signal control distances. The second and third solutions are technically feasible. However, the acceptance by the safety authorities must be clarified. For the purpose of the cost estimation, the second solution has been considered for the Shield Driven Tunnel on the Northern section due to its length of 7.82 km. For all other tunnels and water barriers, the third solution will be applied. This approach is not acceptable for short headways in the future but should be acceptable for the operational scenario of three trains per 2 hours as specified as operational scenario.
3.2.9 Control and supervision of traction power switching
Traction power switching at VCO’s (Voltage Change Over) is out of the “No-CC” solution and must be covered by procedures. The train system itself is protected against erroneous power switching.
3.3 Description of main interfaces
The “No-CC” solution is a standard signaling modification with standard interfaces to interlocking, HMI in the local interlocking and the OCC as well. No particular interfaces to other systems exist. 3.4 Required modifications
3.4.1 Interlocking / HMI (Human Machine Interface) The following modifications are required
• New hardware such as signal control units for the new distant signals and axle counters • Modification of the interlocking software and the HMI software. The distant signal status
could be indicated outside the track scheme on the HMI in order to minimize the modifications
• Implementation of the station to station block with the new axle counter circuit and neutralizing the existing block sectioning
• Installation of indoor key release instruments for branch lines and a sealing the key at a board within the operator room for emergency cross-overs
• Modification of the Block control and supervision function at interlocking and OCC (Operational Control Centre) level
3.4.2 Signals
One distant signal per home in the normal direction of traffic including the control box must be installed.
3.4.3 Point machines and turnouts (Emergency cross over)
The point machines remain connected to the switchblades for supervision and manual reversing, if required. The point will be blocked against throwing at HMI level and by software change (inhibition of unblocking command). Mechanical point locks shall be installed.
3.4.4 Axle Counter
One axle counter circuit for each intersection has to be installed by keeping the existing axle counter system intact to ease the later transfer to the ERTMS system.
3.4.5 Cable Infrastructure
New cables to the distant signals and axle counters are necessary up to the point where sufficient spare conductors are available. To the distant signals, an eight-core cable is required, to the axle counters one quad or a fiber optical cable is required
3.4.6 Required connections Distant Signals – Interlocking
Standard solution by copper cable connection
3.4.7 Key-Release instruments – Interlocking
these turnout might not been used at all during the temporary situation. The access point to the branch lines to Breda and to Zevenbergschen Hoek should be protected either by key-release instruments or by electrical locks, which are integrated in the interlocking logic because the branch lines might be used for maintenance or later for the preparation of the switch over to the final ERTMS system. A more detailed analysis with respect to acceptability from a safety point of view is required at a later phase.
3.4.8 Power Supply No modifications are required.
3.4.9 Installation constraints
Spare places for the new hardware must be made available.
3.5 Schematic drawing of Implementation
Refer to attached drawings regarding Hoofddorp, Rotterdam West and Rotterdam Lombardijen (appendix 7.5 - 7.7)
3.6 Implementation concept Interlocking and wayside Modification
The implementation of the necessary modifications indoor and outdoor does not form any problem. Software changes of the conventional sections could be made during weekends. The level of modification is considered low, without major risks for implementation.
3.6.1 Phases of implementation
The implementation of the all modifications will be made in a one-step approach, section by section.
As a projection change is required at each section, the projections at Hoofddorp and Rotterdam of the SIMIS-C installations are affected. Normal lead time of the supplier (Siemens) is at least 9 months. Also at the border crossing on the Belgian side are modifications required. The implementation time is unknown.
3.6.2 Implementation risks
No major risk for the technical implementation has been identified. Further simplifications are possible for short periods of operation such as cancelling of the key release instrument by sealing the key in the operator room for all points, application of dummy announcing signals also for the normal direction of traffic by reducing the speed to e.g. 80 km/h. Such further simplifications will have to be discussed and agreed at a later stage, if necessary, but should not be the starting point for an alternative solution to the ERTMS. However, any further simplification could only be acceptable for a very short period in agreement with the safety department.
The interface with the Block control and supervision function at interlocking and OCC (Operational Control Centre) is identified as a potential risk. The modifications needed are not standard and should be designed. Solutions to modify automatic Signal operation at the entrances should be made and accepted.